E.F. Johnson Company 53SL ES Series, Руководство по эксплуатации

Страница: 144 / 190

8-10 53SL ES Series Mobile Radio Operating Manual April 2009
Over-the-Air Rekeying (OTAR) Section 8 - Secure Communication (Encryption)
8.5 Over-the-Air Rekeying (OTAR)
“Over-The Air-Rekeying” (OTAR) is the process of sending encryption keys and related
key management messages over-the-air to specific radios. The advantage of OTAR is that
it allows these keys to be quickly and conveniently updated when necessary. It is no longer
necessary to periodically travel to the radio location or bring the radio into a maintenance
facility to load new keys.
The actual OTAR rekeying functions are performed by a Key Management Facility
(KMF) that sends Key Management Messages (KMM) to the RSI (Radio Set Identifier)
assigned to a specific radio or radios. These messages are themselves encrypted using a
unique key called the UKUK (Unique Key Encryption Key). Radios must be OTAR-
compatible, programmed for OTAR, and the UKEK loaded for OTAR for this type of
rekeying to occur.
Note The RSI is enabled in the KMF and must be assigned to the radio under OTAR in PC
Configure.
OTAR is available only on P25 conventional and trunked channels, and only to program
DES-OFB keys. It is not used on SMARTNET/SmartZone channels or to load DES keys.
8.5.1 Encryption Key Types
There are two types of keys used with OTAR:
Traffic Encryption Key (TEK) - The key used to encrypt voice and data traffic. All
radios using encryption must have at least one of these keys.
Key Encryption Key (KEK) - The key used to encrypt keys contained in OTAR Key
Management Messages (KMMs). All radios which use OTAR must contain at least one
of these keys. The KEK used to decrypt/encrypt keys in an OTAR message is defined
by the algorithm and key IDs transmitted in the decryption instructions field. A KEK
may be unique to a particular radio (UKEK) or common to a group of radios (CKEK).
The SMA or KVL-3000 create only UKEKs, therefore you create and load UKEKs
before using OTAR.
8.5.2 Keysets
To simplify key management, OTAR divides the TEK keyspace into multiple sets. Exactly
one of these sets is said to be active at any given time, and only keys in the currently active
set will be selected for use when encrypting voice traffic. The 53SL radio supports two
such keysets, Keyset 1 and Keyset 2. The valid SLN range for Keyset 1 and Keyset 2 is 1
through 4095. 53SL ES radios can be assigned up to 64 SLNs in this range. See Figure 8.1.